gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 04:32:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: workflow-only commits no longer trigger CI and CodeQL

Browse Source 
The 9eb8cac5 filters covered gitlink bumps and prose but not the
workflow files themselves, so every edit to build-agent.yml or a deploy
workflow still cost a full CI and CodeQL run. Neither reads any other
workflow: CI runs the suites and drift guards, CodeQL analyzes C# and
TypeScript. paths-ignore cannot negate, so each file lists the other
twelve workflows explicitly and leaves itself out; .github/scripts and,
for CI, .github/codeql join the list for the same reason.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Oliver Kieselbach
2026-09-04 16:05:21 +02:00
parent a5f74d6abc
commit 38b667799c
2 changed files with 69 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+36 -2
View File
@@ -9,8 +9,8 @@ name: CI
# red run reports rather than blocks. Read the result and follow up.
#
# Path filters: commits that only bump a private submodule gitlink (internal/, infra/,
# .claude/commands) or touch prose cannot change anything the suites cover, so they are
# skipped instead of burning ~15 runner-minutes each. A gitlink bump reports the bare
# .claude/commands), touch prose or edit another workflow cannot change anything the
# suites cover, so they are skipped instead of burning ~15 runner-minutes each. A gitlink bump reports the bare
# path ('internal', no trailing slash), which 'internal/**' does NOT match — both forms
# are listed. GitHub skips only when EVERY changed path matches; a commit that touches
# docs AND code still runs.
@@ -30,6 +30,23 @@ on:
- '.github/FUNDING.yml'
- '.github/dependabot.yml'
- '.github/assets/**'
- '.github/codeql/**'
- '.github/scripts/**'
# Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
# cannot negate, so they are listed one by one; ci.yml itself stays out of the list
# so a change to CI runs CI. A new workflow file is opt-in — add it here too.
- '.github/workflows/bootstrap-script-gates.yml'
- '.github/workflows/build-agent.yml'
- '.github/workflows/build-msi.yml'
- '.github/workflows/codeql.yml'
- '.github/workflows/combine-rules.yml'
- '.github/workflows/deploy-backend.yml'
- '.github/workflows/deploy-mcp.yml'
- '.github/workflows/deploy-web.yml'
- '.github/workflows/indexnow-notify.yml'
- '.github/workflows/oidc-login-test.yml'
- '.github/workflows/pester.yml'
- '.github/workflows/publish-scripts.yml'
pull_request:
branches: [main]
paths-ignore:
@@ -45,6 +62,23 @@ on:
- '.github/FUNDING.yml'
- '.github/dependabot.yml'
- '.github/assets/**'
- '.github/codeql/**'
- '.github/scripts/**'
# Every other workflow: nothing here builds or tests anything CI covers. paths-ignore
# cannot negate, so they are listed one by one; ci.yml itself stays out of the list
# so a change to CI runs CI. A new workflow file is opt-in — add it here too.
- '.github/workflows/bootstrap-script-gates.yml'
- '.github/workflows/build-agent.yml'
- '.github/workflows/build-msi.yml'
- '.github/workflows/codeql.yml'
- '.github/workflows/combine-rules.yml'
- '.github/workflows/deploy-backend.yml'
- '.github/workflows/deploy-mcp.yml'
- '.github/workflows/deploy-web.yml'
- '.github/workflows/indexnow-notify.yml'
- '.github/workflows/oidc-login-test.yml'
- '.github/workflows/pester.yml'
- '.github/workflows/publish-scripts.yml'
workflow_dispatch:
permissions:
.github/workflows/codeql.yml
+33 -1
View File
@@ -6,7 +6,7 @@ name: CodeQL
# A gitlink bump reports the bare path ('internal', no trailing slash), which
# 'internal/**' does NOT match — both forms are listed. A commit that touches docs
# AND code still runs: GitHub skips only when EVERY changed path matches the filter.
# Same list as ci.yml; keep them in step.
# Same list as ci.yml except that each file leaves itself out; keep them in step.
on:
push:
branches: [main]
@@ -23,6 +23,22 @@ on:
- '.github/FUNDING.yml'
- '.github/dependabot.yml'
- '.github/assets/**'
- '.github/scripts/**'
# Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
# paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
# .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
- '.github/workflows/bootstrap-script-gates.yml'
- '.github/workflows/build-agent.yml'
- '.github/workflows/build-msi.yml'
- '.github/workflows/ci.yml'
- '.github/workflows/combine-rules.yml'
- '.github/workflows/deploy-backend.yml'
- '.github/workflows/deploy-mcp.yml'
- '.github/workflows/deploy-web.yml'
- '.github/workflows/indexnow-notify.yml'
- '.github/workflows/oidc-login-test.yml'
- '.github/workflows/pester.yml'
- '.github/workflows/publish-scripts.yml'
pull_request:
branches: [main]
paths-ignore:
@@ -38,6 +54,22 @@ on:
- '.github/FUNDING.yml'
- '.github/dependabot.yml'
- '.github/assets/**'
- '.github/scripts/**'
# Every other workflow: none of them changes the C# or TypeScript CodeQL analyzes.
# paths-ignore cannot negate, so they are listed one by one; codeql.yml itself and
# .github/codeql/ stay out of the list. A new workflow file is opt-in — add it here too.
- '.github/workflows/bootstrap-script-gates.yml'
- '.github/workflows/build-agent.yml'
- '.github/workflows/build-msi.yml'
- '.github/workflows/ci.yml'
- '.github/workflows/combine-rules.yml'
- '.github/workflows/deploy-backend.yml'
- '.github/workflows/deploy-mcp.yml'
- '.github/workflows/deploy-web.yml'
- '.github/workflows/indexnow-notify.yml'
- '.github/workflows/oidc-login-test.yml'
- '.github/workflows/pester.yml'
- '.github/workflows/publish-scripts.yml'
schedule:
# Weekly, so advisories published after a merge still surface. Deliberately
# unfiltered — it re-analyzes the whole tree regardless of what changed, which